@finueva/auth 0.32.0 → 0.34.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/THIRD_PARTY_NOTICES.md +1 -1
- package/dist/device.d.ts +15 -11
- package/dist/device.js +439 -150
- package/dist/index.d.ts +3 -3
- package/dist/index.js +467 -162
- package/dist/server.d.ts +27 -25
- package/dist/server.js +933 -971
- package/dist/{types-BU8vZrhF.d.ts → types-QJnXZXYY.d.ts} +73 -5
- package/package.json +8 -8
package/dist/server.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { $ as
|
|
1
|
+
import { $ as OrganizationPage, At as SocialIdTokenInput, B as InvitationDecline, Bt as UpdateOrganizationTeamDisplayInput, Ct as ResentOrganizationInvitation, D as CreatedOrganizationTeam, E as CreatedOrganizationMemberInvitation, G as OrganizationDisplay, Gt as RegisteredOrganizationApplication, Ht as WorkspaceSelection, J as OrganizationMember, K as OrganizationInvitation, Kt as OrganizationDirectoryEntry, M as DriveCredential, N as DriveCredentialInput, O as DeclineInvitationInput, Q as OrganizationMemberPageInput, Qt as UserApiCredentialInput, St as RemovedOrganizationTeamMember, T as CreatedOrganization, Ut as OrganizationApplicationRegistration, W as OrganizationDeparture, Wt as RegisterOrganizationApplicationInput, X as OrganizationMemberAuthorityV2, Xt as AuthErrorStatus, Y as OrganizationMemberAuthority, Yt as AuthErrorCode, Z as OrganizationMemberPage, Zt as UserApiCredential, at as OrganizationTeamMemberPage, c as AuthOrganization, d as AuthSession, et as OrganizationPageInput, g as CanceledOrganizationInvitation, h as AuthUser, it as OrganizationTeamDisplay, jt as SocialIdTokenProvider, k as DeletedOrganizationTeam, nt as OrganizationSignInStates, o as AddedOrganizationTeamMember, ot as OrganizationTeamPage, q as OrganizationInvitationPage, qt as AuthError, rt as OrganizationTeam, st as OrganizationWorkspaceSelection, t as AcceptInvitationInput, tt as OrganizationSignInState, ut as PersonalWorkspaceSelection, vt as ReceivedOrganizationInvitation, w as CreateOrganizationMemberInvitationInput, xt as RemovedOrganizationMember, yt as ReceivedOrganizationInvitationPage, z as InvitationAcceptance, zt as UpdateOrganizationDisplayInput } from "./types-QJnXZXYY.js";
|
|
2
2
|
//#region src/organization-directory/service.d.ts
|
|
3
3
|
interface OrganizationDirectoryLookupInput {
|
|
4
4
|
organizationId: string;
|
|
@@ -26,7 +26,7 @@ interface FinuevaOrganizationDirectoryAuth {
|
|
|
26
26
|
searchOrganizations(input: OrganizationDirectorySearchInput, serviceAssertion: string): Promise<OrganizationDirectoryPage>;
|
|
27
27
|
}
|
|
28
28
|
/** Server-only directory. A directory entry identifies an incarnation; it grants no membership or billing authority. */
|
|
29
|
-
declare function createOrganizationDirectoryAuth(options: OrganizationDirectoryAuthOptions): FinuevaOrganizationDirectoryAuth;
|
|
29
|
+
export declare function createOrganizationDirectoryAuth(options: OrganizationDirectoryAuthOptions): FinuevaOrganizationDirectoryAuth;
|
|
30
30
|
//#endregion
|
|
31
31
|
//#region src/organization-admission/types.d.ts
|
|
32
32
|
/** Hidden setup identity. This is not organization membership or admission authority. */
|
|
@@ -206,13 +206,13 @@ interface OrganizationAdmissionInputs {
|
|
|
206
206
|
/** Sorted-key JSON. Auth hashes the same form before it compares a signed `bodyDigest` claim. */
|
|
207
207
|
declare function canonical(value: unknown): string;
|
|
208
208
|
/** Hash the strict normalized operation input before signing its bodyDigest claim. No authority is created. */
|
|
209
|
-
declare function organizationAdmissionBodyDigest<Operation extends OrganizationAdmissionOperation>(operation: Operation, input: OrganizationAdmissionInputs[Operation]): Promise<string>;
|
|
209
|
+
export declare function organizationAdmissionBodyDigest<Operation extends OrganizationAdmissionOperation>(operation: Operation, input: OrganizationAdmissionInputs[Operation]): Promise<string>;
|
|
210
210
|
/** Server-only actor and current-admission client. Each call needs a fresh exact-body service assertion. */
|
|
211
|
-
declare function createOrganizationAdmissionAuth(options: OrganizationAdmissionAuthOptions): FinuevaOrganizationAdmissionAuth;
|
|
211
|
+
export declare function createOrganizationAdmissionAuth(options: OrganizationAdmissionAuthOptions): FinuevaOrganizationAdmissionAuth;
|
|
212
212
|
/** Server-only billing capability. It never forwards actor session headers. */
|
|
213
|
-
declare function createOrganizationAdmissionBillingAuth(options: OrganizationAdmissionAuthOptions): FinuevaOrganizationAdmissionBillingAuth;
|
|
213
|
+
export declare function createOrganizationAdmissionBillingAuth(options: OrganizationAdmissionAuthOptions): FinuevaOrganizationAdmissionBillingAuth;
|
|
214
214
|
/** Server-only pending projection. It contains no creator binding and grants no organization authority. */
|
|
215
|
-
declare function createOrganizationAdmissionDirectoryAuth(options: OrganizationAdmissionAuthOptions): FinuevaOrganizationAdmissionDirectoryAuth;
|
|
215
|
+
export declare function createOrganizationAdmissionDirectoryAuth(options: OrganizationAdmissionAuthOptions): FinuevaOrganizationAdmissionDirectoryAuth;
|
|
216
216
|
//#endregion
|
|
217
217
|
//#region src/product-operations/types.d.ts
|
|
218
218
|
type AccountProductOperationPhase = "snapshot" | "consume" | "receipt";
|
|
@@ -270,7 +270,7 @@ interface AccountProductOperationAuthOptions {
|
|
|
270
270
|
timeoutMs?: number;
|
|
271
271
|
}
|
|
272
272
|
/** Server-only. Every call needs a fresh assertion for its exact phase audience. No call retries automatically. */
|
|
273
|
-
declare function createAccountProductOperationAuth(options: AccountProductOperationAuthOptions): AccountProductOperationConsumer & {
|
|
273
|
+
export declare function createAccountProductOperationAuth(options: AccountProductOperationAuthOptions): AccountProductOperationConsumer & {
|
|
274
274
|
audience(phase: AccountProductOperationPhase): string;
|
|
275
275
|
};
|
|
276
276
|
//#endregion
|
|
@@ -338,7 +338,7 @@ interface UserApiVerifierOptions {
|
|
|
338
338
|
now?: () => number;
|
|
339
339
|
}
|
|
340
340
|
/** One configured verifier can be shared. It retains public keys, never user authority. */
|
|
341
|
-
declare function createUserApiVerifier(options: UserApiVerifierOptions): {
|
|
341
|
+
export declare function createUserApiVerifier(options: UserApiVerifierOptions): {
|
|
342
342
|
verify(token: string): Promise<UserApiIdentity>;
|
|
343
343
|
};
|
|
344
344
|
//#endregion
|
|
@@ -358,7 +358,7 @@ interface FinuevaIdentityResolverAuth {
|
|
|
358
358
|
resolveIdentity(input: ResolveIdentityInput, clientAssertion: string): Promise<ResolvedIdentity | null>;
|
|
359
359
|
}
|
|
360
360
|
/** Server-only identity resolution. Keep results private; they grant no product authority. */
|
|
361
|
-
declare function createIdentityResolverAuth(options: IdentityResolverAuthOptions): FinuevaIdentityResolverAuth;
|
|
361
|
+
export declare function createIdentityResolverAuth(options: IdentityResolverAuthOptions): FinuevaIdentityResolverAuth;
|
|
362
362
|
//#endregion
|
|
363
363
|
//#region src/membership-resolution.d.ts
|
|
364
364
|
interface MembershipResolverAuthOptions {
|
|
@@ -400,7 +400,7 @@ interface FinuevaMembershipResolverAuth {
|
|
|
400
400
|
resolveMembershipBatch(input: ResolveMembershipBatchInput, clientAssertion: string): Promise<ResolvedMembershipBatch>;
|
|
401
401
|
}
|
|
402
402
|
/** Server-only organization membership resolution. Keep results private; they are Auth authority, not product authority. */
|
|
403
|
-
declare function createMembershipResolverAuth(options: MembershipResolverAuthOptions): FinuevaMembershipResolverAuth;
|
|
403
|
+
export declare function createMembershipResolverAuth(options: MembershipResolverAuthOptions): FinuevaMembershipResolverAuth;
|
|
404
404
|
//#endregion
|
|
405
405
|
//#region src/drive-recipients.d.ts
|
|
406
406
|
interface DriveRecipientAuthOptions {
|
|
@@ -424,7 +424,7 @@ interface FinuevaDriveRecipientAuth {
|
|
|
424
424
|
resolveRecipient(input: ResolveDriveRecipientInput, clientAssertion: string): Promise<DriveRecipient>;
|
|
425
425
|
}
|
|
426
426
|
/** Service authority only. The caller signs assertions; Auth verifies their claims and signature. */
|
|
427
|
-
declare function createDriveRecipientAuth(options: DriveRecipientAuthOptions): FinuevaDriveRecipientAuth;
|
|
427
|
+
export declare function createDriveRecipientAuth(options: DriveRecipientAuthOptions): FinuevaDriveRecipientAuth;
|
|
428
428
|
//#endregion
|
|
429
429
|
//#region src/provisioning.d.ts
|
|
430
430
|
interface DriveProvisioningAuthOptions {
|
|
@@ -442,7 +442,7 @@ interface FinuevaDriveProvisioningAuth {
|
|
|
442
442
|
getDriveProvisioningCredential(clientAssertion: string): Promise<DriveProvisioningCredential>;
|
|
443
443
|
}
|
|
444
444
|
/** Service authority only. Never pass an incoming User request or session to this client. */
|
|
445
|
-
declare function createDriveProvisioningAuth(options: DriveProvisioningAuthOptions): FinuevaDriveProvisioningAuth;
|
|
445
|
+
export declare function createDriveProvisioningAuth(options: DriveProvisioningAuthOptions): FinuevaDriveProvisioningAuth;
|
|
446
446
|
//#endregion
|
|
447
447
|
//#region src/user-directory.d.ts
|
|
448
448
|
interface UserDirectoryEntry {
|
|
@@ -505,7 +505,7 @@ interface FinuevaUserDirectoryAuth {
|
|
|
505
505
|
resolveUserBinding(input: UserDirectoryLookupInput, assertion: string): Promise<UserDirectoryBinding | null>;
|
|
506
506
|
}
|
|
507
507
|
/** Server-only service assertions. This client has no session authority and performs no automatic retry. */
|
|
508
|
-
declare function createUserDirectoryAuth(options: UserDirectoryAuthOptions): FinuevaUserDirectoryAuth;
|
|
508
|
+
export declare function createUserDirectoryAuth(options: UserDirectoryAuthOptions): FinuevaUserDirectoryAuth;
|
|
509
509
|
//#endregion
|
|
510
510
|
//#region src/organization-role-events/index.d.ts
|
|
511
511
|
type Role = "owner" | "admin" | "member";
|
|
@@ -578,7 +578,7 @@ interface FinuevaOrganizationRoleEventsV2Auth {
|
|
|
578
578
|
listRoleEvents(input: OrganizationRoleEventsInput, assertion: string): Promise<OrganizationRoleEventsV2Page>;
|
|
579
579
|
}
|
|
580
580
|
/** The stored checkpoint is older than the history Auth retains. Events between it and `earliest` are gone. */
|
|
581
|
-
declare class OrganizationRoleEventCheckpointExpiredError extends AuthError {
|
|
581
|
+
export declare class OrganizationRoleEventCheckpointExpiredError extends AuthError {
|
|
582
582
|
readonly earliest: string;
|
|
583
583
|
constructor(earliest: string);
|
|
584
584
|
}
|
|
@@ -587,9 +587,9 @@ declare class OrganizationRoleEventCheckpointExpiredError extends AuthError {
|
|
|
587
587
|
* Each page is checked against the request: the application, an ordered and unique event list, and a checkpoint
|
|
588
588
|
* that never moves backwards.
|
|
589
589
|
*/
|
|
590
|
-
declare function createOrganizationRoleEventsAuth(options: OrganizationRoleEventsAuthOptions): FinuevaOrganizationRoleEventsAuth;
|
|
590
|
+
export declare function createOrganizationRoleEventsAuth(options: OrganizationRoleEventsAuthOptions): FinuevaOrganizationRoleEventsAuth;
|
|
591
591
|
/** Explicit version 2. Never downgrades or retries a version 1 response. */
|
|
592
|
-
declare function createOrganizationRoleEventsV2Auth(options: OrganizationRoleEventsAuthOptions): FinuevaOrganizationRoleEventsV2Auth;
|
|
592
|
+
export declare function createOrganizationRoleEventsV2Auth(options: OrganizationRoleEventsAuthOptions): FinuevaOrganizationRoleEventsV2Auth;
|
|
593
593
|
//#endregion
|
|
594
594
|
//#region src/organization-lifecycle/index.d.ts
|
|
595
595
|
/** The only reason Auth accepts. Auth records it; Auth does not verify billing state. */
|
|
@@ -659,15 +659,17 @@ interface FinuevaOrganizationLifecycleAuth {
|
|
|
659
659
|
* Hash the strict closure input before signing it as the assertion's `bodyDigest` claim, with `applicationId` as a
|
|
660
660
|
* claim too. Auth refuses an assertion whose digest does not match the request it receives. No authority is created.
|
|
661
661
|
*/
|
|
662
|
-
declare function organizationServiceClosureBodyDigest(input: OrganizationServiceClosureInput): Promise<string>;
|
|
662
|
+
export declare function organizationServiceClosureBodyDigest(input: OrganizationServiceClosureInput): Promise<string>;
|
|
663
663
|
/**
|
|
664
664
|
* Server-only service assertions for an application's organization lifecycle work. The client has no session
|
|
665
665
|
* authority and performs no automatic retry. Each answer is checked against its request.
|
|
666
666
|
*/
|
|
667
|
-
declare function createOrganizationLifecycleAuth(options: OrganizationLifecycleAuthOptions): FinuevaOrganizationLifecycleAuth;
|
|
667
|
+
export declare function createOrganizationLifecycleAuth(options: OrganizationLifecycleAuthOptions): FinuevaOrganizationLifecycleAuth;
|
|
668
668
|
//#endregion
|
|
669
669
|
//#region src/server.d.ts
|
|
670
|
-
interface ServerAuthOptions {
|
|
670
|
+
export interface ServerAuthOptions {
|
|
671
|
+
/** Allow RFC1918 HTTP application origins. Enable only in local development. */
|
|
672
|
+
allowPrivateNetworkAppOrigin?: boolean;
|
|
671
673
|
authOrigin: string;
|
|
672
674
|
appOrigin: string;
|
|
673
675
|
request: Request;
|
|
@@ -675,16 +677,16 @@ interface ServerAuthOptions {
|
|
|
675
677
|
now?: () => number;
|
|
676
678
|
timeoutMs?: number;
|
|
677
679
|
}
|
|
678
|
-
interface ServerSignOutResult {
|
|
680
|
+
export interface ServerSignOutResult {
|
|
679
681
|
applyCookies(headers: Headers): void;
|
|
680
682
|
}
|
|
681
|
-
interface ServerInvitationAcceptance extends InvitationAcceptance {
|
|
683
|
+
export interface ServerInvitationAcceptance extends InvitationAcceptance {
|
|
682
684
|
applyCookies(headers: Headers): void;
|
|
683
685
|
}
|
|
684
|
-
interface ServerSocialIdTokenSession extends AuthSession {
|
|
686
|
+
export interface ServerSocialIdTokenSession extends AuthSession {
|
|
685
687
|
applyCookies(headers: Headers): void;
|
|
686
688
|
}
|
|
687
|
-
interface FinuevaServerAuth {
|
|
689
|
+
export interface FinuevaServerAuth {
|
|
688
690
|
acceptInvitation(input: AcceptInvitationInput): Promise<ServerInvitationAcceptance>;
|
|
689
691
|
declineInvitation(input: DeclineInvitationInput): Promise<InvitationDecline>;
|
|
690
692
|
getSession(): Promise<AuthSession | null>;
|
|
@@ -731,6 +733,6 @@ interface FinuevaServerAuth {
|
|
|
731
733
|
getUserApiCredential(input: UserApiCredentialInput): Promise<UserApiCredential>;
|
|
732
734
|
signOut(): Promise<ServerSignOutResult>;
|
|
733
735
|
}
|
|
734
|
-
declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
|
|
736
|
+
export declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
|
|
735
737
|
//#endregion
|
|
736
|
-
export { type AcceptInvitationInput, type AccountProductOperationAuthOptions, type AccountProductOperationConsumer, type AccountProductOperationInput, type AccountProductOperationPhase, type AccountProductOperationProof, type AccountProductOperationReceipt, type AccountProductOperationSnapshot, type AccountProductOperationSnapshotInput, type AddedOrganizationTeamMember, type AmendOrganizationAdmissionInput, type AttestOrganizationAdmissionInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type CurrentOrganizationAdmissionInput, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinalizeOrganizationAdmissionInput, type FinalizedOrganizationAdmission, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, type FinuevaOrganizationAdmissionAuth, type FinuevaOrganizationAdmissionBillingAuth, type FinuevaOrganizationAdmissionDirectoryAuth, type FinuevaOrganizationDirectoryAuth, type FinuevaOrganizationLifecycleAuth, type FinuevaOrganizationRoleEventsAuth, type FinuevaOrganizationRoleEventsV2Auth,
|
|
738
|
+
export { type AcceptInvitationInput, type AccountProductOperationAuthOptions, type AccountProductOperationConsumer, type AccountProductOperationInput, type AccountProductOperationPhase, type AccountProductOperationProof, type AccountProductOperationReceipt, type AccountProductOperationSnapshot, type AccountProductOperationSnapshotInput, type AddedOrganizationTeamMember, type AmendOrganizationAdmissionInput, type AttestOrganizationAdmissionInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type CurrentOrganizationAdmissionInput, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinalizeOrganizationAdmissionInput, type FinalizedOrganizationAdmission, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, type FinuevaOrganizationAdmissionAuth, type FinuevaOrganizationAdmissionBillingAuth, type FinuevaOrganizationAdmissionDirectoryAuth, type FinuevaOrganizationDirectoryAuth, type FinuevaOrganizationLifecycleAuth, type FinuevaOrganizationRoleEventsAuth, type FinuevaOrganizationRoleEventsV2Auth, type FinuevaUserDirectoryAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationAdminContact, type OrganizationAdminContacts, type OrganizationAdminContactsInput, type OrganizationAdmission, type OrganizationAdmissionActorOperation, type OrganizationAdmissionActorProof, type OrganizationAdmissionAuthOptions, type OrganizationAdmissionBillingSetup, type OrganizationAdmissionCreator, type OrganizationAdmissionIdentity, type OrganizationAdmissionIdentityInput, type OrganizationAdmissionInputs, type OrganizationAdmissionOperation, type OrganizationAdmissionPage, type OrganizationAdmissionPageInput, type OrganizationAdmissionReceipt, type OrganizationAdmissionSelection, type OrganizationAdmissionSetup, type OrganizationAdmissionSetupInput, type OrganizationApplicationRegistration, type OrganizationDeparture, type OrganizationDirectoryAuthOptions, type OrganizationDirectoryEntry, type OrganizationDirectoryLookupInput, type OrganizationDirectoryPage, type OrganizationDirectorySearchInput, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationLifecycleAuthOptions, type OrganizationMember, type OrganizationMemberApplicationAccess, type OrganizationMemberApplicationAccessInput, type OrganizationMemberAuthority, type OrganizationMemberAuthorityV2, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationPresenceAuthorization, type OrganizationPresenceInput, type OrganizationRoleEvent, type OrganizationRoleEventPriorRoles, type OrganizationRoleEventReason, type OrganizationRoleEventRoles, type OrganizationRoleEventUser, type OrganizationRoleEventV2, type OrganizationRoleEventsAuthOptions, type OrganizationRoleEventsInput, type OrganizationRoleEventsPage, type OrganizationRoleEventsV2Page, type OrganizationServiceClosure, type OrganizationServiceClosureInput, type OrganizationServiceClosureReason, type OrganizationSignInState, type OrganizationSignInStates, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RegisterOrganizationApplicationInput, type RegisteredOrganizationApplication, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ReserveOrganizationAdmissionInput, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type UserDirectoryAuthOptions, type UserDirectoryBinding, type UserDirectoryEntry, type UserDirectoryListInput, type UserDirectoryLookupInput, type UserDirectoryMember, type UserDirectoryMembersInput, type UserDirectoryMembersPage, type UserDirectoryPage, type UserDirectoryResolveInput, type WithdrawOrganizationAdmissionInput, type WorkspaceSelection, type canonical };
|